Lab 01 · API security
A valid session is not permission to read a record.
Explore Broken Object Level Authorization (BOLA) with fixed synthetic identities and records. Then inspect and run the original backend source and its test suite locally.
Interactive local simulation · No API calls
Try the request as a different principal
Start with Alice reading Bob's record: the vulnerable path returns it; the guarded path refuses. Everything here is synthetic and runs in your browser.
GET /vulnerable/documents/doc-202Choose an identity, document and handler, then run the simulated request.
Trust-boundary visualization
The local source repository uses fixed demo tokens to illustrate the boundary. Production authentication must independently verify identity, session state and every resource action.
Try the same boundary from a native client
The public repository also includes a SwiftUI iOS Simulator app and Kotlin Android Emulator app. Both make real requests to the loopback-only synthetic Node service on the development machine. Their builds were tested; these are not distributed App Store applications.
Reproduce the exact class of failure locally
The linked public repository includes Node.js 20+ source, synthetic fixtures and native Node test runner checks. It listens on localhost only; the vulnerable handler is intentionally unsuitable for any networked deployment.
git clone https://github.com/DemonicBinary/api-authorization-lab.git cd api-authorization-lab npm test npm start # A tenant's own document: HTTP 200 curl -i -H "Authorization: Bearer demo-alice" \ http://127.0.0.1:8765/guarded/documents/doc-101 # Cross-tenant access: guarded 404, vulnerable 200 curl -i -H "Authorization: Bearer demo-alice" \ http://127.0.0.1:8765/guarded/documents/doc-202
No real credentials, customer tenants or production API are used. The demo token is not an authentication design.